ShareDeFi Protocol Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

ShareDeFi Protocol (SHADE) is a BNB Chain reflection token deployed on 1 March 2021 at 0x9e1c8ef6…b56991. Its owner can set the transfer tax (setTaxFee) and the liquidity fee (setLiquidityFee) to any number with no upper limit. The fees are computed as a share of the amount out of 10,000 and subtracted with SafeMath, so a _taxFee above 10,000 (100%) makes every taxed transfer, including every sale into the PancakeSwap pair, revert, while fee-exempt addresses such as the deployer keep moving tokens.

The tax fee is redistributed to holders through the reflection total. Only the liquidity fee is credited to the token contract, which swaps it for BNB it holds itself, and the owner-only balanceSH sends the contract's BNB to the owner. De.Fi's REKT database lists ShareDeFi Protocol as an exit scam/honeypot, stating that the contract owner could disable the transfer function and so stop users from selling their tokens.

How it happened

  1. The constructor gives the deployer the whole 100,000 SHADE supply, creates the PancakeSwap pair, and marks only the deployer and the token contract in isExcludedFromFee. The owner can add or remove exemptions with setExcludedFromFee.
  2. For any transfer where neither side is exempt, collectFee computes taxFee = amount.mul(_taxFee).div(10**(_feeDecimal + 2)), that is _taxFee out of 10,000, and runs transferAmount = transferAmount.sub(taxFee).
  3. It then subtracts a liquidity fee: a fixed 3% (_liquidityFeeSell = 300) when the caller is the PancakeSwap router, as in a sale, or _liquidityFee out of 10,000 otherwise.
  4. setTaxFee(uint256 fee) and setLiquidityFee(uint256 fee) are owner-only and store any value. A _taxFee above 10,000 makes the fee larger than the amount, so the subtraction reverts every taxed sale, purchase and wallet transfer; a high value below that, such as 9,000 (90%), leaves the recipient a small fraction of an amount debited in full from the sender.
  5. The liquidity fee is credited to the token contract, and on transfers not sent by the pair the contract sells its token balance for BNB to itself through swapTokensForEth. The owner-only balanceSH() then sends the contract's BNB to the owner; no code adds it to liquidity.
  6. tradingEnabled starts as true and no function sets it back to false, so the transfer block comes from the fee setters, not a trading switch. renounceOwnership() would freeze the fees at their current values.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract SHADE

Evidence

Same attack technique

Browse all hacks →
BNB Chain ONYX Loss not disclosed BNB Chain Unstoppable Loss not disclosed Ethereum Shyft Network Loss not disclosed Ethereum Lepricon Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes